IBM QRadar

 View Only

 System Requirements for EP based on EPS Rate Limits

Jump to  Best Answer
Mykhailo Honcharov's profile image
Mykhailo Honcharov posted Fri February 06, 2026 10:39 AM

I've got a question regarding a way system requirements are measured for Event Processors.

Say, I've got a single Event Processor with two attached Event Collectors. 20K EPS are allocated to Event Processor which are inherited by both attached Event Collectors as well. Event Processor is not ingesting any events in and on itself, all the incoming events are ingested by attached Event Collectors.

If I were to follow official sizing guidance for QRadar virtual appliances should I size my Event Processor in accordance with ≤ 20000 EPS resource values (Suggested 32 CPU & 64 RAM) or maybe I should look at ≤ 40000 EPS resource values as both collectors amount to 40K EPS in total. Or better yet - maybe I should size my EP to ≤ 5000 EPS resources as it is not actively ingesting any data which is proven by average and peak metrics in qradar.log (around 100 AVG EPS & 150 Peak EPS which are system events I guess)?

I'm a bit frustrated about which usecases IBM meant when coming up with EPS-based requirements in the official doc.

Perf1's profile image
Perf1 posted Mon February 09, 2026 09:18 AM  Best Answer

You need to size the EP based on the EPS is has to process, regardless whether it does collection or not. In your case you need to size and license the EP for 40K EPS (license in order to be in compliance and size in order to be able to process 40K and be supported). Don't forget that a processor does not only process (i.e. CRE, Writing to storage) but also participates in searching and the host resources are shared for those tasks.  

Dusan VIDOVIC's profile image
Dusan VIDOVIC posted Mon February 09, 2026 04:49 AM

Just a note that there is a component doing a license check at the entry to the EP from EC.  Since ECs inherit the licenses from the processor they’re attached to, and there can be multiple EC instances feeding into a single processor appliance, this  licensing check is done to ensure that the original EPS rate is maintained regardless of the number of collectors attached to the processor.

Related Content